STIGQter: STIG Summary: Infoblox 8.x DNS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Jan 2021:

Infoblox DNS servers must protect the authenticity of communications sessions for dynamic updates.

DISA Rule

SV-233918r621666_rule

Vulnerability Number

V-233918

Group Title

SRG-APP-000219-DNS-000029

Rule Version

IDNS-8X-700013

Severity

CAT II

CCI(s)

• CCI-001184 - The information system protects the authenticity of communications sessions.

Weight

10

Fix Recommendation

Infoblox Systems can be configured in two ways to limit DDNS client updates. Refer to the Administrator Guide for detailed instructions.

For clients that support GSS-TSIG:
1. Navigate to Data Management >> DNS >> Members tab.
2. Review each server with the DNS service enabled.
3. Select each server, click "Edit", toggle Advanced Mode, and select GSS-TSIG.
4. Configure the option "Enable GSS-TSIG authentication of clients".
5. Upload the required keys.
6. When complete, click "Save & Close" to save the changes and exit the "Properties" screen.
7. Perform a service restart if necessary.

For clients that do not support GSS-TSIG:
1. Navigate to Data Management >> DNS >> Members tab.
2. Review each server with the DNS service enabled.
3. Select each server and click "Edit".
4. Select the "Updates" tab.
5. Select an existing Named ACL or configure a new set of ACEs to limit client DDNS.
6. When complete, click "Save & Close" to save the changes and exit the "Properties" screen.
7. Perform a service restart if necessary.

Check Contents

Infoblox Systems can be configured in two ways to limit DDNS client updates.

For clients that support GSS-TSIG:
1. Navigate to Data Management >> DNS >> Members tab.
2. Review each server with the DNS service enabled.
3. Select each server, click "Edit", toggle Advanced Mode, and select GSS-TSIG.
4. Verify that "Enable GSS-TSIG authentication of clients" is enabled.
5. When complete, click "Cancel" to exit the "Properties" screen.

For clients that do not support GSS-TSIG: 1. Navigate to Data Management >> DNS >> Members tab.
2. Review each server with the DNS service enabled.
3. Select each server and click "Edit".
4. Select the "Updates" tab.
5. Verify that either a Named ACL or set of Access Control Entries (ACEs) is used to limit client DDNS updates.
6. When complete, click "Cancel" to exit the "Properties" screen.

If clients that support GSS-TSIG do not have "Enable GSS-TSIG authentication of clients" set or a named ACL or set of ACEs for clients that do not support GSS-TSIG, this is a finding.

Vulnerability Number

V-233918

Documentable

False

Rule Version

IDNS-8X-700013

Severity Override Guidance

Infoblox Systems can be configured in two ways to limit DDNS client updates.

For clients that support GSS-TSIG:
1. Navigate to Data Management >> DNS >> Members tab.
2. Review each server with the DNS service enabled.
3. Select each server, click "Edit", toggle Advanced Mode, and select GSS-TSIG.
4. Verify that "Enable GSS-TSIG authentication of clients" is enabled.
5. When complete, click "Cancel" to exit the "Properties" screen.

For clients that do not support GSS-TSIG: 1. Navigate to Data Management >> DNS >> Members tab.
2. Review each server with the DNS service enabled.
3. Select each server and click "Edit".
4. Select the "Updates" tab.
5. Verify that either a Named ACL or set of Access Control Entries (ACEs) is used to limit client DDNS updates.
6. When complete, click "Cancel" to exit the "Properties" screen.

If clients that support GSS-TSIG do not have "Enable GSS-TSIG authentication of clients" set or a named ACL or set of ACEs for clients that do not support GSS-TSIG, this is a finding.

Check Content Reference

M

Target Key

5251

Comments